Industry Analysis
DEF CON 33 Software Supply Chain Sessions Recap
DEF CON 33 brought hacker-energy attention to package ecosystems, CI/CD abuse, and AppSec Village. Here is what supply chain defenders should take home.
Feb 2, 20267 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
DEF CON 33 brought hacker-energy attention to package ecosystems, CI/CD abuse, and AppSec Village. Here is what supply chain defenders should take home.
When to choose IAST, when to choose DAST, and when to run both. A decision framework for 2026 with concrete coverage, cost, and integration tradeoffs.
A 2026 survey of static analysis tools for Swift focused on security findings: what works, what does not, and where the iOS and server-side gaps remain.
A hands-on comparison of Snyk and Veracode in 2026: developer experience, scan accuracy, SCA depth, SAST tradeoffs, and where each tool actually earns its license cost.
The OWASP Top 10:2025 release candidate, published November 2025, splits Vulnerable Components into a broader Software Supply Chain Failures category and elevates Security Misconfiguration to #2.
After 14 Rails audits in the last 12 months, the same eight issues kept surfacing. Here's the 2025 field checklist for Rails 7.2 and 8.0 enterprise apps.
A step-by-step guide to launching a security champions program that scales your security team's influence across engineering without hiring a dozen new AppSec engineers.
How to make code reviews an effective security checkpoint without turning every PR into a week-long security audit.
Weekly insights on software supply chain security, delivered to your inbox.